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and 

Glen D. Ritter 

Marshall Space Flight Center 
SUMMARY 


A detailed study was made of manual backup control systems suitable for 
the first stage of the Saturn V launch vehicle. A technique to measure the 
manual control system reliability with a piloted simulator was developed. 

Two manual backup control systems were considered: a "load relief" and a "no 

load relief" system. Both systems allowed the pilot to close an adaptive 
control loop that is parallel to the primary automatic control system. The 
system failure modes associated with the primary system, as well as those 
associated with the additional hardware for the piloted backup system, were 
considered. An analog piloted simulation was used and included rigid-body, 
engine- actuator, vehicle-bending, propellant-sloshing, and control -system 
dynamics. Over a thousand simulated flights with randomly selected failures 
were made with three research pilots. The results indicate that for the 
failure modes and automatic system considered, the piloted manual backup sys- 
tem can reduce the probability of mission failure by a factor of 2. Trajec- 
tory dispersions at first-stage cutoff were significantly reduced. The 
hand- controller and pressure-suit configurations had little effect on system 
performance . 


INTRODUCTION 


Since early 1963, the Ames Research Center and the George C. Marshall 
Space Flight Center (MSFC) have been jointly investigating the problem of 
piloted guidance and control of large launch vehicles. Early studies of this 
group and others (refs. 1-5) have established the feasibility for this class 
of vehicles. 

At the conclusion of these feasibility studies, the question was posed: 
"Can the probability of mission success be improved by incorporating the 
pilot in a backup mode to the primary automatic control system of the Saturn 
V launch vehicle?" The purpose of the present investigation was to answer 
this question. 



The first section of this report is a description of the system to be 
controlled and its environment. It also includes a discussion of the candi- 
date manual backup control systems to be considered, as well as a discussion 
of the constraints on the guidance and control system. The second section 
outlines the technique used to measure the reliability contributed by the 
addition of a manual backup control system. It also discusses the failure 
modes considered, the details of the simulation used, and pilot procedures. 

The third section discusses the results obtained, which include structural 
loads experienced, trajectory dispersions, and mission reliability. The 
effect of pressure-suit and hand- controller configurations on performance is 
also discussed. 

Some of the results presented herein are also presented in reference 6. 
The purpose of this report is to amplify these results and, in addition, to 
discuss several other aspects of the problem. A discussion of handling qual- 
ities, hand- controller and pressure-suit configurations, and detailed pilot 
procedures are added. In addition, more complete data on structural loads and 
trajectory dispersions are included. 

This investigation was limited to the first stage of flight, the S-IC. 


VEHICLE AND CONTROL SYSTEM DESCRIPTION 


The Saturn V vehicle configuration (fig. 1) has three booster stages, an 
instrument unit, and the Apollo spacecraft. The vehicle has a relatively 
high fineness ratio (length/diameter) with a first flexible body mode fre- 
quency of about 1 Hz. Several of the propellant tanks have significant slosh- 
ing modes with frequencies of about 0.5 Hz. 

The first stage burns for approximately 150 seconds. Figure 2 shows some 
typical trajectory parameters. Maximum dynamic pressure, q, occurs at about 
78 seconds. The maximum thrust-to-weight ratio, T/mg 0 , reaches almost 5. 

The first stage is powered by five F-l engines. The attitude of the 
Saturn V during the first stage is controlled by swiveling the four outboard 
F-l engines. Each engine is swiveled in the pitch and yaw planes by separate 
hydraulic actuators. Roll is controlled by combined use of pitch and yaw 
actuators . 

The feasibility study (ref. 1) indicated that a piloted control system 
including load relief (reduction of aerodynamic loads) had merit; however, 
the load relief feature requires additional hardware. Therefore, two manual 
backup control systems were proposed for study: a "load relief" system and a 

"no load relief" system. Figure 3 shows the elements of these systems. The 

solid lines in the lower half of the figure indicate the elements of a launch- 

vehicle automatic control system. Reference 7 presents a comprehensive dis- 
cussion of this system. The engine actuator command signals are attitude 
rate and attitude error, summed, gained, and filtered in the control computer. 

The configuration of the filters used during the study is presented in 
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appendix A. The solid lines in the upper half of the figure indicate perti- 
nent (to manual launch control) existing spacecraft control-system components. 
Existing pilot display items include the attitude, altitude, velocity, flight- 
path angle, etc., of the spacecraft. The dashed lines indicate the items 
added for the proposed manual backup systems. These items will be discussed 
in detail below. Not shown in figure 3 are switches that allow the pilot to 
selectively open the attitude rate or attitude error feedback loops making up 
the engine actuator commands. Both systems allowed the pilot to form an adap- 
tive parallel control loop that he can activate when failures occur in the 
primary system. 


Load Relief System 

Attitude error, from the launch- vehicle guidance system, as well as out- 
puts from body-mounted accelerometers in the launch vehicle was added to the 
pilot display for the load relief system. The accelerometers were located 
near the instantaneous center of rotation of the vehicle (ref. 1) so that 
their outputs were nearly proportional to qa, the product of dynamic pressure 
and angle of attack. Aerodynamic loads on the vehicle are directly related 
to this product. The output of the pilot f s controller was passively filtered 
and summed with the output of the launch-vehicle automatic system at the con- 
trol computer. This filter was a passive second-order network with natural 
frequency of 2.7 rps and a damping ratio of 0.5. 

To determine whether the characteristics of the automatic control system 
were satisfactory for manual control, a brief investigation was made. A pilot 
was asked to fly the simulated vehicle with various settings of the gains in 
the automatic control system. The pilot's subjective opinion of the system 
and system performance data were recorded for each combination. The pilot 
opinion data are shown in figure 4, and the maximum structural bending moment 
experienced, ratioed to the breakup value, is shown in figure 5. The. 
abscissas indicate the rate loop gain used. The units are in degrees of 
engine gimbal command per degree per second of attitude rate. The ordinates 
indicate the attitude loop gain used (degrees of engine gimbal command per 
degree of attitude error). A pilot opinion rating of 3-1/2 or less is con- 
sidered satisfactory, while a rating of 4-1/2 or less is considered acceptable 
for normal operation (ref. 8). Figures 4 and 5 indicate that while higher 
values of damping (rate gain) are desirable, the nominal values for the auto- 
matic system are satisfactory. These nominal values cause the vehicle rigid- 
body short-period mode to have (near maximum dynamic pressure) a natural 
frequency of about 0.8 rad/sec and a damping ratio of about 0.4. 


No Load Relief System 

The no load relief system was identical to the load relief system except 
that it had no body-mounted accelerometers or associated display. 
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GUIDANCE AND CONTROL CONSTRAINTS 


The principal constraints on the launch-vehicle guidance and control 
system are guidance accuracy and structural loads. Since the study reported 
here considers the first stage of flight, structural loads were the primary 
constraint. The equation used for calculating the ratio of maximum vehicle 
structural bending moment to breakup bending moment is 


where 
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M body bending moment normalized to unity at a factor of safety of 1 

a aerodynamic angle of attack, deg 

$2 swivel angle of the ith control engine, deg 

n. acceleration at the nose of the vehicle of the jth flexible body 

normal mode, m/sec 2 

amplitude of the kth propellant tank sloshing mass, m 

The effect of propellant sloshing damping forces was neglected. The partial 
derivatives above were assumed to be time varying. Typical values near the 
time of flight corresponding to high q are as follows: 
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Because of the different vehicle loading for one engine thrust out, the 
following equation was used for this failure mode: 



The primes on the partial derivatives indicate different values corresponding 
to the different longitudinal loading in the vehicle. The f3 Q term results 
from unsymmetrical vehicle loading, while T i/ T n is the ratio of actual 
thrust of the ith engine to nominal thrust. 

While not as significant during first-stage control, trajectory disper- 
sions were also calculated as a measure of guidance performance. Distance 
and velocity normal to the nominal trajectory at first-stage cutoff were used. 

Two synthetic wind magnitude profiles were used for this study. They 
were obtained from reference 9 and are shown in figure 6. The steady-state 
value of the larger magnitude profile will not be exceeded 95 percent of the 
time during the windiest month of the year nor will its vertical shear be 
exceeded 99 percent of the same time period. The steady-state value of the 
other profile will not be exceeded 50 percent of the same time period. Peak 
wind shear occurs near the altitude corresponding to vehicle maximum dynamic 
pressure. A preliminary investigation showed that the small- amplitude gusts 
discussed in reference 9 had little effect on the manual control problem. Two 
wind directions were chosen, 135° and 225° relative to vehicle launch heading. 
Previous experience has shown that these quartering winds are the most 
difficult for piloted control. 


METHOD OF ANALYSIS 


The systematic analysis technique used to assess the effect of the 
piloted backup system on system reliability and mission success is similar to 
one that has been used for the automatic system. It is also similar to the 
"Pilot-Controller Integration for Emergency Conditions" concept (ref. 10), 
which was refined and applied to the X-22A V/STOL vehicle (ref. 11). 

The seven steps of the technique are shown in figure 7 and are discussed 
below . 


1. Define the system. Collect the necessary information on the vehicle, 
systems, trajectory, mission, etc., to enable a simulation to be conducted. 
Define the manual control system. 

2. Define the major failure modes. Predict major failure modes, define 
failure dynamics and obtain necessary information to simulate failure modes, 
obtain unreliability number (probability of occurrence) for each major 
failure mode. 
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3. Simulate the system and failure modes. Use the data gathered in 
steps 1 and 2 and appropriate mathematical models to develop a real-time 
piloted flight simulation of the vehicle and its major failure modes. 

4. Define the pilot procedures. Use the flight simulation developed in 
step 3 to conduct a systematic investigation wherein the failure modes inves- 
tigated are made to occur at various times of flight with the pilot in control 
of the simulated vehicle. From this investigation, develop a background of 
information from which the crew can learn to detect and correctly identify 
each failure as well as to follow the correct pilot procedure in the event of 
a failure. (Most of the emergency section of the pilot's handbook is written 
during this study phase. Also, at this time, preliminary changes to the 
proposed manual system can be made.) 

5. Conduct simulation with random failures. Use several subjects and a 
large number of simulated flights with random failures to determine the 
conditional probability of mission failure (effectivity) for each of the major 
failure modes. 

6. Calculate the probability of mission failure. Use the unreliability 
numbers from step 2 and the effectivity numbers from step 5 to calculate the 
failure mode criticality (effect of failure on probability of mission 
failure) . 


7. Modify the system and procedures as necessary. Analyze the results 
of step 6 to determine which failure modes have the greatest influence on mis- 
sion failure. Redesign the system of step 1 or modify the procedures 
developed in step 4 as necessary to reach a suitable level of "probability of 
mission success." 

The application of these seven steps to the first stage of Saturn V 
follows . 


Step 1: Define the System 

The system is defined in the preceding Vehicle and Control System 
Description. 


Step 2: Define the Major Failure Modes 

The launch-vehicle major failure modes (as opposed to component failure 
modes) can be divided into three categories: control-system hardware failures 

(sensors, wiring, etc.), engine actuator failures (hard over, null, oscillat- 
ing), and thrust failures. The first 10 failures in figure 8 are the major 
failure modes for the launch vehicle considered in the order of their assumed 
unreliabilities (probabilities of occurrence). The unreliability numbers are 
typical for Saturn V. Failure modes 11 through 19 are associated with the 
displays and controller, which were added for the piloted backup system. 

The unreliability data for the pilot displays are not shown because, as will 
be seen later, no mission failures were caused by a display failure. 
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Failure 1 in figure 8, one engine actuator hard over, can be caused by a 
servoamplifier or a valve blockage. It was simulated by a step change in the 
actuator command to a saturate value. 

Failure 2, loss of thrust on one control engine, is caused by a loss of 
thrust chamber pressure and was simulated by a step change on one engine, to 
zero thrust. 

Failure 3, pitch and yaw actuators inoperative on the same engine, can 
be caused by a loss of hydraulic pressure on one engine. The engine will 
then drift under the influence of the aerodynamic, inertial, and thrust mis- 
alinement forces present. It was simulated by drifting the engine to either 
hard-over deflection in pitch and yaw (5°) or to a 2.5° deflection in pitch 
and yaw. 

Failure 4, loss of the attitude reference platform, can be caused by 
hard-over platform. The hard-over signal is interrupted by the reasonableness 
check in the digital computer. The attitude error signal is then frozen at 
the last reasonable value. It was simulated by freezing the attitude error 
signal at the value existing just before the time of failure. 

Failure 5, one engine actuator oscillatory, can be caused by a failure 
of the mechanical feedback from actuator to value. It was simulated by open- 
ing the position feedback loop in the simulated engine actuator dynamics. 

Failure 6, loss of attitude rate signal to the control computer, can be 
caused by a rate gyro or demodulator going to null. It was simulated by a 
step change to zero on the attitude rate signal. 

Failure 7, one engine actuator inoperative, can be caused by a servo- 
amplifier output going to null, causing the engine deflection to null in one 
axis. It was simulated by a step change to zero in the actuator command. 

Failure 8, loss of attitude error signal to the control computer in one 
axis, can be caused by a failure between the launch vehicle data adapter and 
the summing amplifier in the control computer so that the attitude error 
signal path is opened or blocked. It was simulated by a step change to zero 
on the attitude error signal. 

Failures 9 and 10, attitude signal saturate and attitude rate signal 
saturate, can result from a control computer failure. The saturated attitude 
signal was simulated by a step change to 11.5° in the attitude error signal. 
The saturated rate signal was simulated by a step change to 10.0° per second 
in the attitude rate signal. 

Failure 11, attitude display lock, jump, or drift, can be caused by a 
variety of component failures (e.g., loss of motor drive or loss of feedback). 
Failure 11 was simulated by causing the drive signal to the display to freeze 
at the time of failure value, to jump to some arbitrary value, or to start 
drifting at a constant rate from the time of failure value. 
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Failures 12 through 17, attitude -error, attitude-rate, and accelerometer 
null or saturate, were simulated by a step change in the displayed signal to 
null or saturate, respectively. 

Failures 18 and 19, the pilot's hand controller null or saturate, were 
simulated by a step change in one axis of the controller output to null or 
saturate, respectively. 

Step 3: Simulate the System and Failure Modes 

Display panel. - A comprehensive fixed-cab analog simulation was used. 

The display panel (fig. 9) was representative of Apollo. The all-attitude 
indicator in the center of the panel displayed vehicle attitude on the sphere. 
For the load relief manual system, attitude error was displayed on the auxil- 
iary meters on the left and top of the indicator with the outputs of the body- 
mounted accelerometers displayed on the flight director needles. Attitude 
error for the no load relief manual control system was displayed on the flight 
director needles (no acceleration signal was displayed) . Attitude rates were 
presented on three separate indicators as shown. The clock used is just to 
the left of the all-attitude indicator. The following nominal boost attitude 
profile is plotted around its circumference for comparison with the mission 
time as displayed by the sweep second hand of the clock. 



If it is assumed that the second hand is shown in the zero mission time posi- 
tion, the nominal attitude should be 90°. One full minute later, the nominal 
attitude is 66°. The nominal attitude at staging (2-1/2 min) is 23°. The 
failure warning lights are to the right and below the all-attitude indicator. 
The lower five lights indicate thrust loss on any one of the five F-l engines. 
Of the remaining lights, only the one labeled "L/V Guidance" was used. This 
light indicates a failure in the launch-vehicle attitude reference platform. 

The six switches at the lower left of the panel could be used to open the 
three rate and three attitude loops in the automatic system. The hand- 
controller switch activated the pilot's representative three-axis hand control- 
ler. A thumb button switch on the controller could be used (in parallel with 
the one on the instrument panel) to activate the controller. 

Pilot's hand controllers .- Two hand controllers were used in this study: 
an Ames controller and an Apollo Block I controller. The Ames three-degree 
rotational hand controller was used for the basic data of the reliability 
study (fig. 10). It is a sidearm controller having three rotational degrees 
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of freedom that command the roll, pitch, and yaw of the vehicle. Strain 
gages mounted on flexure pivots provide the electrical output signal. The 
handle is mass balanced for use in a high g environment. The characteristics 
of this controller are shown as output voltage versus displacement and torque 
in figure 11. A nonlinearity was added to the Ames controller output, which 
gave the pilot a variable gain controller that desensitized his input for 
trajectory control, and yet gave him full authority at maximum displacement 
for handling failure situations. The characteristics of this nonlinearity 
are shown in figure 12. 

An Apollo Block I hand controller was obtained for an evaluation and com- 
parison with the Ames controller (fig. 13). It is a three-axis rotational 
hand controller with discrete and proportional outputs. The proportional 
mode was used for this study. Its output voltage versus displacement and 
torque characteristics are shown in figure 14. The controller is character- 
ized by large breakout forces with values equal to 50 percent of maximum 
values . 

Pressure suit.- While the basic data of the reliability study were 
obtained with the pilots in shirt sleeve garb, a pressure suit was obtained 
for one of the pilots to determine its effects on pilot performance. The 
Gemini type pressure suit (model SPD- 766-1 made by International Latex Corpo- 
ration) shown in figure 15 was used both in the pressurized and unpressurized 
mode. In the event of a cabin pressure failure in the Apollo Command Module, 
the suit pressure is maintained at 3.7 psia. This pressure differential was 
simulated for the pressurized mode with a gage pressure of 3.7 psi above 
atmospheric pressure. A compressed air- flow rate of 4 ft 3 /min was used for 
body cooling. Figure 16(a) shows the pilot, with a nonpressuri zed suit, 
seated in the simulator cab with the Apollo Block I hand controller. The 
"ballooning’* effects of pressurization can be seen by comparing this figure 
with figure 16(b). 

Equations of motion .- Time-varying coefficient, linearized equations of 
motion were simulated to describe vehicle dynamics. These included three 
propellant sloshing modes, two flexible-body modes, six degree-of-freedom 
rigid-body dynamics, engine actuator dynamics, and the control-system shaping 
networks. The equations used are similar to, but more extensive than, those 
of reference 1. A 400-amplifier analog computer complex with extensive func- 
tion generation capability was used. Switching was used to allow selective 
simulation of the various system failure modes. 


Step 4: Define the Pilot Procedures 

Initial simulation results were used to develop a comprehensive set of 
pilot procedures. The complete procedures are presented in appendix B and 
are summarized below. 

The primary task of the pilot before a system failed was to monitor the 
displays. His only control inputs (load relief system only) were those neces- 
sary for load relief in the event of large wind-induced aerodynamic loads. 
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He reduced the loads by closing the piloted parallel loop by use of the dis- 
played output signals of the body-mounted accelerometers. Reducing these 
aerodynamic loads gives the vehicle a greater margin of safety in the event 
of a system failure. 

In the event of failure of the launch-vehicle system (i.e., failures 1 
to 10), the pilot’s "overriding" procedure was to keep the attitude of the 
vehicle at the nominal value. He did this by operating as an adaptive element 
in the loop that paralleled the automatic flight-control system. 

For hardware failures in the launch-vehicle control system (i.e., loss 
of platform, attitude rate, attitude signal, etc.), the pilot used informa- 
tion displayed from sensors located in the spacecraft to stabilize and con- 
trol the vehicle attitude. Specifically, if the launch-vehicle attitude-rate 
loop malfunctions (i.e., failure 6 or 10) and the vehicle motions become 
unstable, the pilot, using the displayed-rate information (which is sensed 
from gyros located in the spacecraft), takes over and stabilizes the vehicle 
motions. If hard-over control system failures occur, the pilot removes the 
saturated signal by activating the appropriate switch on. the display panel. 

In the case of engine actuator or loss of thrust failures, the vehicle 
develops asymmetric rotational moments. In this case, the pilot acts as an 
integration- type element in that he injects trimming or bias commands to null 
the unbalanced or asymmetric rotational moments. The unsymmetrical loading 
caused by a loss of thrust can be further reduced by a small bias of the 
nominal attitude toward the failed engine. This induces an alleviating 
aerodynamic load on the vehicle. 

When a single display failed, the information displayed was sufficiently 
redundant that the pilot was able to detect which instrument had failed and 
continue to fly the vehicle using the remaining displayed information. The 
pilot used the ground rule that two indications of a failure were necessary 
before he assumed control of the vehicle using the backup control system. 


Step 5: Conduct Simulation With Random Failures 

The following items had to be considered for the actual conduct of the 
simulation with random failures: the basis for performance comparison, 

simulation variables, pilot training, and briefing. 

Basis for performance comparison.- The principal consideration was "Is 
the automatic flight-control system plus a piloted backup system more or less 
reliable than the automatic flight-control system taken alone?" The reli- 
ability level of the automatic flight-control system forms the reference con- 
dition, thus making it necessary to measure the reliability of the automatic 
system using the same flight simulation setup, the same flight conditions, 
etc. , that were used for the piloted system. 

Simulation vari ables.- Several variables were considered in the simula- 
tion: the number of failures (19 for the load relief system, 17 for the 
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no load relief system, and 10 for the automatic system) , the wind magnitude 
(2, previously described), time of failure (3 major times; before, at, and 
after high q) , and the direction of the wind with respect to the failure 
(i.e., for some failures the vehicle turns into or away from the wind). From 
these variables, it was determined that there were 176 basic failure situa- 
tions for the load relief system, 166 for the no load relief system, and 116 
for the automatic system. To make the number of failures approximately pro- 
portional to the unreliability, 79 additional situations were added. Each 
of three pilots flew 255 simulated flights using the load relief system. 

Since many of the no load relief system situations were similar to the load 
relief system situations only an abbreviated study was conducted. One pilot 
was used for 92 simulated flights. A single unknown (to the pilot) failure 
occurred at an unknown time during each flight. Display and controller fail- 
ures were deleted for the automatic system reliability study, resulting in 
195 simulated flights. 

Pilot tra ining and briefing .- A pilot training period preceded the simu- 
lated flight series with random failures. The time required varied because 
of previous pilot experience, but averaged about 30 hours per pilot. For 
the simulated flight series with random failures, the pilot was briefed on 
the wind direction and magnitude before each flight. 


RESULTS AND DISCUSSION 


Reliability Considerations 

Step 5, in the analysis procedure discussed above, provided the neces- 
sary data for calculating failure mode effectivity (conditional probability 
of mission failure). 

To illustrate the data reduction technique, simulation data for one 
system failure (one actuator hard over) and one wind magnitude (95 percent) 
utilizing the load relief control system are shown in figure 17. The times 
of failure are indicated along the abscissa in the three major time divisions. 
For the pre-max q and max q time of flight, the direction in which the 
hard-over actuator turns the vehicle with respect to the wind is also shown 
along the abscissa. The maximum structural bending moment, normalized to a 
factor of safety of 1, experienced during the flight is presented on the 
ordinate. For this example in figure 17, 3 flights (of a total of 45) 
exceeded the breakup value. These occurred near the time for the maximum wind 
shear. They were considered unsuccessful flights and yielded an effectivity 
(conditional probability of mission failure) of 0.045, This was calculated 
by noting that during the 40-second high q time period (150 seconds is the 
total first-stage flight time) 3 of the 18 flights were unsuccessful. Since 
the failure mode unreliability numbers are assumed proportional to time and 
there were no failures during the pre- and post-max q time periods, this 
gives an effectivity of (3/18) (40/150) = 0.045. 

Simulation data for the example failure for the no load relief and the 
automatic control systems have been added to the data of figure 17 and are 


11 



shown in figure 18. The effectivity for the no load relief system was com- 
puted as 0.322, which allows for the fact that there was not an equal number 
of failure samples that turned the vehicle away from the wind as into the 
wind, the effectivity for the automatic system was computed as 0.488. For 
this example, both piloted systems improve system reliability. Also, for this 
example, the load relief system significantly improves performance over the 
no load relief system (effectivity was reduced from 0.322 to 0.045). Fig- 
ure 19 summarizes the structural load data for the 19 failure modes. (It 
should be noted that the maximum computer scaling for the ordinate was 1.5; 
therefore, if this value was exceeded, 1.5 was used in computing the average 
values.) The effectivity numbers calculated using this data are summarized 
in figure 20. 

Step 6 in the analysis method (calculate the probability of mission 
failure) is presented in tabular form in figure 20. The 19 failure modes of 
figure 8 are in the first column with the unreliability numbers (probability 
of occurrence) in the second column. The effectivity numbers (conditional 
probability of mission failure, given occurrence of the failure mode) for the 
failures occurring with a 95- or a 50-percent wind are given in the fourth 
and sixth columns, respectively. The failure mode criticalities (the probabil- 
ities of mission failure) are the products of the unreliability and effectiv- 
ity numbers and are indicated for the two wind conditions in columns five and 
seven. The effectivity and criticality numbers are given for the three sys- 
tems investigated. The systems are noted in column three. As an example, 
consider the typical failure situation previously discussed: one actuator 

hard over, load relief system, and a 95-percent wind. The failure mode 
criticality is equal to the unreliability multiplied by the effectivity, or 
(5450xl0“ 6 ) (0 .045) = 245><10 -6 , as indicated by the first bar of column five. 

The overall first-stage mission criticality, obtained by summing the individ- 
ual failure criticalities, is shown at the bottom of the figure. Adding the 
individual failure criticalities to obtain mission criticality numbers assumes 
that the probability of more than one failure mode occurring during the first- 
stage flight is small. The results show (for the failure modes considered) 
that adding a piloted load relief backup control system reduces mission crit- 
icality by a factor of better than 2. For the 50-percent wind case, the no 
load relief system performs nearly as well as the load relief. For the 
95-percent wind, adding the body-mounted accelerometers whereby the pilot 
could provide load relief, significantly improves the performance. 

Step 7 of the analysis technique would feed back the results of figure 20 
into changes in the system or pilot procedures. While this was not carried 
out for the present investigation, several interesting results are shown in 
figure 20. 

The pilot can effectively compensate for certain engine actuator failures 
(nos. 1, 3, and 7 in fig. 20) and for the loss of the attitude reference plat- 
form in the launch vehicle (no. 4). For the other vehicle failure modes 
with significantly high unreliability numbers, the pilot contributed little 
to improving the mission reliability. 
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Loss of roll-attitude rate (no. 6), attitude-signal saturate (no. 9), 
and attitude-rate signal saturate (no. 7) require opening the automatic 
control-system loops with one of the six switches in the lower left of the 
display panel (fig. 9). Since the unreliability numbers for these failures 
are negligible, the criticality payoff is small considering the additional 
system complexity. 

The pilot could detect the loss of the launch-vehicle attitude platform 
(no. 4) or loss of the launch-vehicle attitude signal (no. 8) by monitoring 
the displayed attitude-error signal from the launch vehicle. He compared 
this signal with the difference between vehicle attitude displayed on the 
attitude indicator (generated in the spacecraft) and the nominal attitude 
profile on the clock. Since the unreliability number associated with failure 
8 is small, and failure 4 has a warning light, the criticality payoff asso- 
ciated with the display of launch-vehicle attitude-error signal again seems 
small . 

Based on these considerations, it appears that the manual backup system 
of this study could be simplified without significant performance loss. The 
simpler system would include only the following elements in addition to those 
presently in the spacecraft. 

(1) Three-axis proportional manual inputs summed with the output of the 
launch-vehicle automatic system control computer. These manual signals 
should be passively filtered to attenuate signal amplitudes at vehicle 
flexible body frequencies. 

(2) Display of load relief information to the pilot. This could be 
from body-mounted accelerometers, angle-of-attack indicators, or perhaps the 
spacecraft digital computer. 

Three additional results that may have application to other backup manual 
control systems are: 

(1) The effect of pilot display failures had no effect on mission 
criticality (failures 11 through 17 of fig. 20 have zero effectivity) because 
sufficiently redundant information was presented and because the ground rule 
used by the pilot was that "two separate indications are necessary before a 
failure is assumed." 

(2) With sufficient practice, the pilot could adapt to the failure 
dynamics from a strictly monitor mode as fast as from a more active mode of 
control. This is indicated by the fact that the mission criticality numbers 
in figure 20 for the 50-percent wind for the load relief and no load relief 
systems are almost the same. For the no load relief system, the pilot is 
strictly a monitor and takes no control action until he detects a failure; 
whereas for the load relief system, he actively reduces structural bending 
moments due to aerodynamic loading by controlling the outputs of the body- 
mounted accelerometers. (The small difference in effectivity also indicates 
that the payoff for accelerometer control for this wind magnitude is small.) 


13 



(3) An implicit result of this study, as well as earlier feasibility 
studies, is the ease with which the pilot can filter the flexible body 
effects from displayed signals. In the backup mode of operation considered, 
the pilot was required to act as an adaptive parallel loop to the automatic 
system. Depending on the failure mode, he was required to close attitude, 
attitude rate, and/or accelerometer load-relief loops. By observing his dis- 
play panel, the pilot quite easily distinguished and disregarded the flexible 
body content of these sensor signals. 


Trajectory Dispersions 

The discussion so far has centered around the maximum structural bending 
moment as a measure of mission success. An additional performance index that 
can be considered is the trajectory dispersions. While dispersions do not 
affect mission success directly in first-stage flight, they must be kept 
within limits to allow the upper-stage guidance system to perform adequately. 
The trajectory dispersions obtained during the study are summarized in fig- 
ure 21. Data for automatic system flights that were successful, piloted load 
relief flights with the same failure situations as the auto pilot runs, all 
successful piloted flights for the load relief system, and all successful 
piloted flights for the no load relief system are shown for each failure. 

The pilot contributed the most when large attitude errors (i.e., thrust loss 
and engine actuator failures) were introduced. Acting as an integration ele- 
ment in the parallel piloted loop, he minimized these attitude errors. The 
first two columns for each failure mode in figure 21, automatic flights and 
comparable load relief system flights, indicate that the average dispersions 
were reduced from 5000 to 2570 m and from 91 to 47 m/sec. This result could 
be significant to the upper-stage guidance problem. The third and fourth 
columns compare the performance for all successful load relief and no load 
relief system flights. The no load relief system has smaller trajectory dis- 
persions as the attitude of the vehicle is held closer to nominal values. 


Pressure Suit and Hand Controller Evaluation 

Since the study had used a shirt-sleeve environment for the simulation 
pilots, a short investigation of the effect of a pressure suit on pilot per- 
formance was made. A Gemini-type pressure suit was obtained from the Manned 
Spacecraft Center for this study. In addition, an Apollo Block I hand control 
ler was obtained from MSC and used with the pressure suit. 

Pressure suit .- The effect of pilot suit was investigated for a number of 
failure situations. Three modes of pilot garb were studied: (1) shirt sleeve 

(2) Gemini-type pressure suit on but not inflated, and (3) pressure suit on 
and inflated to 3.7 psig. Data for one subject were obtained as only one 
pilot could wear the semicus tom-fitted pressure suit. Typical data are shown 
for the actuator hard-over failure situation in figure 22. The data show that 
the reliability contribution, as measured by the bending moment ratio, is not 
decreased significantly when the pilot is clothed in a pressure suit, even 
when the suit is inflated. These data along with the results for other types 
of failures are summarized in figure 23. The average of the bending moment 
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ratio is plotted for the various system failures for the three suit modes. 

An overall average for all failure cases is plotted on the right. A small 
decrease in average bending moment was obtained with the deflated suit. This 
is believed to be due to pilot training. Inflating the pressure suit tends to 
degrade the ability of the pilot to fly smoothly and, consequently, it 
degraded performance slightly. The pilot commented that it was difficult to 
apply smooth precise inputs with the pressurized glove, particularly in pitch. 

Hand controller .- Several of the failure situations flown using the Ames 
controller were duplicated by two of the subjects, using the Apollo Block I 
hand controller. Typical data are shown for the same actuator failure cases 
in figure 24. No distinct advantage is apparent for either controller. The 
data show the Ames controller better for failures during pre-max q region 
and vice versa for max q region. A summary of the controller results for 
several failures is shown in figure 25. Average values of maximum-bending 
moment to breakup-bending moment ratios are plotted versus failure types for 
the two controllers. The overall average for all failures is shown on the 
right. The data indicate that either controller could be used satisfactorily 
with no significant performance difference. Pilot comments, however, tend 
to favor the Ames controller over the Apollo Block I controller. The high 
breakout force of the Apollo Block I controller made it difficult to make 
small precise inputs. 


CONCLUSIONS 


A detailed study has been made of manual backup control systems for the 
first stage of Saturn V. It was concluded that: 

1. The handling qualities of the booster with the nominal automatic 
system are satisfactory for manual control. 

2. A comprehensive set of pilot procedures was developed that allowed 
the pilot to satisfactorily control most failure situations. 

3. An analysis method was developed that allowed the systematic determi- 
nation of the reliability contribution of a pilot to a complex control system. 
The results indicate that for the failure modes and automatic system con- 
sidered, the piloted manual backup system can reduce the probability of 
mission failure by a factor of 2. 

4. Single failures of the pilot* s display instruments do not affect 
mission success. 

5. The pilot was able to control a failure situation from a monitor mode 
as well as from a more active control mode. 

6. For the Saturn V vehicle, the pilot can act as a highly effective, 
frequency selective filter. 
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7. Trajectory dispersions were significantly reduced for the manual 
control case, particularly for those failure modes causing large attitude 
errors to be developed by the automatic system. 

8. Pressure-suit and hand- controller configurations had little effect 
on pilot performance. 


Ames Research Center 

National Aeronautics and Space Administration 

Moffett Field, Calif., 94035, Feb. 13, 1969 
125-19-01-39-00-21 
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APPENDIX A 


CONTROL SYSTEM FILTER CONFIGURATION 


The launch-vehicle control-system configuration is shown in the sketch 
below. All three control axes are similar. A set of preliminary filters 

was obtained from the Marshall Space 



Flight Center (MSFC) at the beginning 
of the study and used for the data 
presented in the report. At the con- 
clusion of the study, a later set of 
filter configurations were obtained 
and the effect on performance measured. 

The preliminary filter configura- 
tions used for the pitch and yaw axes 
were 


Att i tude : 


Rate : 


a 0 (5 . 8) 2 

s 2 + 2(0 .5) (5 . 8) s + (5 .8) 2 

a x (5.8) 2 

s 2 + 2(0 .5) (5 . 8) s + (5 .8)2 


where 

t» a 0 , a l> 

sec deg/deg deg/deg/sec 

0 - 120 0.5 0.5 

120 - 150 .2 .3 


The later configuration of filters used for the pitch and yaw axes were 

Attitude: a Q (12.6)(s + 0.0951) 

(s + 0.0379) (s + 31.7) 


Rate : 


a 1 (93.1)[s 2 + 2(0.14) (11. 15)s + ( 11 . 15 ) 2 ] 
(s + 2 . 10) (s + 6 . 25) (s + 15 . 38) (s + 57.4) 
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where 



^ > 3.(3 > > 

sec deg/deg deg/deg/sec 

0 - 100 0.82 0.657 

100 - 120 .45 .438 

120 - 150 .15 .2 


There were no significant differences in performance for the two sets of 
filters, although a small increase in performance was noted for failure 5 
(fig. 8), one actuator oscillatory. 

No control system filters were used in the roll axis as no flexible body 
dynamics were simulated in this axis. The preliminary loop gains used in the 
roll axis for the study were 


a Q = 0.173 deg/deg 


a^ = 0.106 deg/deg/sec 

While the later filters had slightly different values for loop gains in the 
roll axis, the effect was not investigated. 
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APPENDIX B 


PILOT PROCEDURES 


The following preliminary emergency procedures were developed and used by 
the simulation pilots during this study. The discussion covers each type of 
system failure considered, the indications of failure available to the pilot, 
and the pilot procedure subsequent to failure identification. The discussion 
relates to the control system shown in figure 3. 


SATURN V EMERGENCY PROCEDURES 
(S-IC STAGE) 


A. RATE SIGNAL TO CONTROL COMPUTER 

The primary cause of trouble in the rate signal to the control computer 
is the rate gyro itself, but others are possible (wiring, etc.)* Two types 
of failure signals are considered probable: signal to null or signal to 

saturate. 

Pitch or Y aw Signal to Null 

In this failure mode, the pitch or yaw rate signal to the control com- 
puter changes instantaneously from its normal value to zero. This changes the 
rigid-body dynamics from a well-damped oscillatory system to a divergent 
oscillatory system (period = 15-20 sec for flight up to t = 120 sec). In 
addition, the lower modes of elastic dynamics are no longer phase stabilized 
and now operate essentially open loop (they are still coupled to a small 
extent by the attitude signal) with less damping. 

Indications: 1. Rate, attitude, and accelerometer (during high q) displays 

start a divergent oscillation with a period of 
15-20 seconds. 

2. Elastic dynamics (apparent mostly on accelerometer signal) 
becomes more lightly damped. 

Procedure: 1. Provide rate damping by using displayed attitude rate signal. 

Roll Signal to Null 


In this failure mode, the roll rate signal to the control computer goes 
to null. Since the attitude loop is still closed, a high-frequency undamped 
oscillation builds up in the roll channel. 
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Indications: Roll rate and attitude displays start a high-frequency divergent 

oscillation difficult for the pilot to control. 

Procedure: 1) Disconnect roll attitude augmentation. 

2) Continue flight and provide manual rate and attitude 
augmentation in roll channel. 

Pitch, Yaw, or Roll Signal Saturate 

In this failure mode, the rate gyro signal to the control computer in 
one axis changes instantaneously from its normal value to a saturated (limited) 
value of 10°/sec. The rate loop signal to the engine will then be 5° of engine 
angle for a pitch or yaw signal saturate (a Q = 0.5 before 120 sec), and 0.5° 
for roll. If the other signals to the engine are small, the engines will 
attempt to go hard over. As the vehicle diverges, the attitude loop and pilot 
will be making corrective inputs to decrease the engine angle. 

At high q (t = 70 sec) and under the influence of a maximum design wind, 
the vehicle reaches its design load in about 0.3 second. This increases to 
almost a full second for -a failure at t = 40 seconds with the maximum design 
wind; while at t = 130 seconds, where q is negligible, the vehicle never 
reaches its design load, but diverges initially in attitude at about 6 or 
7 deg/sec. 

This failure mode is uncontrollable unless the augmentation system for 
the affected axis can be disconnected. In most cases, the Emergency Detection 
System (EDS) will cause an automatic abort before any pilot action is 
possible. 

Indications: 1. Indications of rate, attitude, and accelerometer rapidly 

diverge . 

2. Pilot controller has no apparent effect. 

3. There is large normal acceleration at the pilot ! s station. 

Procedure: 1. Disengage the augmentation system from the affected channel 

as soon as possible. 

2. Regain control and continue the flight, flying the affected 

channel manually. 

3. Standby for automatic abort during high q region of 

flight. 

B. ATTITUDE SIGNAL TO CONTROL COMPUTER 

Three types of failures are considered possible in the attitude signal 
to the control computer: signal to null (single axis), signal to saturate 

(single axis), and signal locks (all axes). 
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Pitch, Yaw, or Roll Signal to Null 


An open circuit in the attitude control loop is a controllable situation. 
However, a large transient will occur at the time of failure if an attitude 
error exists (engine command will change by a Q A<f>) . 

Indications: Loss of attitude stabilization is evidenced by a divergent 

motion of attitude and accelerometer displays. 

Procedure: Provide attitude stabilization manually. 

Pitch or Yaw Signal to Saturate 


If for some reason, the attitude loop signal steps abruptly to a saturate 
level of 11-1/2° coincident with a severe wind spike, the pilot has about a 
half second to abort. For Emergency Detection System (EDS) vehicle rate 
limits of ±4 deg/sec, the abort will be automatic since this rate is exceeded 
under the above conditions. If the failure occurs after t = 120 sec (a Q 
changes from 0.5 to 0.2), it is possible to control the vehicle; however, the 
rate limit is again exceeded. 


Indications : 

1 . 

Rapid divergence of attitude signal. 



2. 

Step change in attitude rate. 



3. 

Abrupt normal acceleration at pilot station 

(±0.8 g). 

Procedure : 

1 . 

Disengage the attitude augmentation from the 
channel . 

affected 


2. 

Continue flight with manual control. 



3. 

Standby for automatic abort during high q 
flight . 

region of 


Roll Signal to Saturate 

If the roll attitude error signal saturates, the vehicle will go into a 
steady-state roll rate. 

Indications: Steady-state roll rate. 

Procedure: Override attitude signal with controller and continue flight. 

Signal Freeze 


Certain failures in the L/V inertial platform can cause the attitude 
error signal to the control computer to freeze at the value present at time 
of failure. 
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Indications: Loss of attitude stabilization in all axes. 

Procedure: Continue flight with manual attitude stabilization in all axes. 

C . ENGINE ACTUATOR FAI LURES 


Four types of engine actuator failures are considered possible: one 

actuator to null, two actuators drifting (same engine), one actuator hard over, 
and one actuator oscillatory. 


One Actuator to Null 

With loss of engine angle command signal, the actuator will abruptly go 
to the null position. This situation is easily controlled, but the loss of 
the actuator reduces the available thrust control component and causes an 
unbalanced roll torque when only three engines respond to a pitch or yaw com- 
mand. A compensating roll input signal must, therefore, accompany a pitch 
command if one pitch actuator control is lost. Likewise, if one yaw actuator 
control is lost, a compensating roll input must accompany a yaw command. The 
roll attitude indicator is used to determine the sense and amount of roll 
input under these conditions. There will be similar, but smaller in magnitude, 
cross -coup ling effects for pure roll inputs. 

Indications: 1. Cross-coupling of roll with pitch or yaw command input. 

2. Reduction of control power. 

Procedure: 1. Fly attitude ball to obtain nominal conditions (cross- 

coupled inputs are required) . 

Two Actuators Drifting (Same Engine) 

Loss of all hydraulic pressure on one engine (due to a hydraulic pump 
failure) will allow both actuators to drift under the influence of aerodynamic 
forces, thrust bias, and inertial effects due to eg offset. Depending on 
the magnitude and direction of these forces, the engine can drift to a vari- 
ety of positions. It is quite probable that it will drift up to the limit 
gimbal deflection of 5° in both axes. 

While the failure is controllable, if it occurs during high q, the 
transient while regaining control of the vehicle may overload the vehicle. 


Indications : 


1. Cross -coupling of roll with pitch and yaw inputs. 


Procedure : 


2. Reduction of control power on all axes. 
1. Regain control and continue flight. 


2. For failures before high q, save some control authority 
for load reduction at wind spike. 
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Actuator Hard Over 


A hydraulic system failure could cause the actuator to abruptly move to 
the limit of its travel, that is, saturate at an engine angle of ±5° (pitch 
or yaw). In addition to incurring a large pitching or yawing moment, a roll 
rate of about 8 deg/sec is induced. This condition can be satisfactorily 
controlled by a continuous compensating stick command input. 


Indications 

: 1 . 

Abrupt roll rate. 


2. 

Abrupt pitch or yaw rate. 


3. 

Cross-coupling of roll with pitch or yaw command input. 


4. 

Reduction in control power. 

Procedure : 

1 . 

Fly attitude ball to obtain nominal conditions (cross- 
coupled inputs are required) . 


2. 

Steady roll bias command input necessary. 

Actuator Oscillatory 

Under certain conditions (loss of actuator feedback) , the hydraulic 
actuator vehicle system could abruptly go into an oscillatory mode at approxi 
mately 1/2 cps with ±5° engine angle amplitude. This induces large oscilla- 
tory loads in the booster structure, along with noticeable oscillatory normal 
g loading at the command module station. If this failure occurs during the 
high q region of flight, the extra loading can cause the vehicle to exceed 
structural limits , 

Indications 

: 1 . 

Rapid buildup of lateral or vertical oscillatory loads at 
the pilot station up to about ±0.6 g. 


2. 

Abrupt buildup of pitch or yaw oscillation rate, coupled 
with an oscillatory roll rate. 


3. 

Oscillatory pitch or yaw and roll attitudes. 

Procedure : 

1 . 

Disconnect attitude and attitude rate augmentation in 
channel with bad actuator (pitch or yaw). Leave roll 
augmentation in. 


2. 

Continue flight providing stabilization in the affected 
channel . 
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D. LOSS OF THRUST ON ONE CONTROL ENGINE 

The mechanics involved in a thrust failure can best be explained by an 
example: i 



The structural loading in the vehicle is radically changed when the example 
engine thrust fails. First, with the compressive load in the vehicle now 
reduced by about 1/5, the load-carrying capability of the vehicle is changed. 
Since the vehicle is critical in tension (mostly due to interstage structure), 
the load- carrying capability will be less . In addition, with the engine posi- 
tions nulled, there is a relative compression on one side of the vehicle due 
to no. 3 engine thrust. 


Relative compression 



If it is desired to balance this load, the remaining engines must be swivelled 
about 4° (52 < time < 89 sec, data for other times were not available). 


Loterol component of 
thrust vector acting 
on vehicle base 
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The control problem also changes considerably when the example engine thrust 
fails. The unbalanced thrust of no. 3 engine causes an attitude acceleration 
on the order of 2°/sec 2 . To null this attitude acceleration requires about 2° 
of engine angle. 



About 2° engine angle 
to null vehicle attitude 
acceleration 


With this condition, it can be seen that there will still be a relative com- 
pression load on the vehicle. The pilot notes the loss of engine thrust in 
several ways: 

1. Attitude acceleration causes buildup of attitude rate and angle. 

2. Initial attitude acceleration causes a step jump in the 
accelerometer display. 

3. Engine out causes warning light on display panel. 

4. Longitudinal acceleration is decreased by 1/5. 

The first cue usually detected by the pilot is the accelerometer needle jump. 




FDA! 


This initial needle jump at thrust failure varies from about 0.7 to 0.4 inch, 
depending on time of failure. 

Because of the engine angle (2°) required to null attitude acceleration, 
the accelerometer needles will have a bias even after control has been 
regained. 
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No. I out 



FDAI 



The magnitude of this bias as shown by the accelerometer needles is about 1/3 
inch for all times of flight. 

If the vehicle is in a region where the aerodynamic pressure is high 
enough to develop significant lateral aerodynamic forces, another possibility 
exists to modify the loading in the vehicle. With the attitude acceleration 
nulled out as above, a residual relative compression load still exists on the 
no. 3 engine side of the vehicle. 



Since the predominant aerodynamic forces on the vehicle are developed at the 
nose and tail fins, a wind from no. 3 engine side will cause a balancing load. 
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This will cause an additional accelerometer indication (about 1/3 inch at 
max q) in the same direction as that to null the attitude acceleration. 


Zero load condition 



It can be seen that if the pilot attempts to null the accelerometer display 
in a high dynamic pressure region, he will increase the loading on the 
vehicle . 


Indications: As noted above. 


Procedure : 


1. Maintain control of the vehicle. 


2. Identify which engine has failed as soon as possible 

(engine out light) . 

3. Regain attitude control of vehicle. 

4. Bias the accelerometer display needles up to 2/3 inch away 

from the failed engine for high q flight regions. 

5. If failure occurs prior to high q save some controller 

authority for load relief at wind spike. 

6. Because of marginal vehicle strength with a failed engine, 

be prepared for abort. 

7. If necessary, switch attitude program to secondary mission 

profile . 


E. DISPLAY AND CONTROLLER FAILURES 


Attitude Rate Display 


Since the pilot’s attitude rate display is used only for monitoring or 
in the event of other subsystem failures, failure of the rate display itself 
should have small effect. By comparing its output with the attitude and 
other displays, failure of the attitude rate display can be verified. 
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Attitude Error Display 

Since the attitude error signal is generated in the L/V, it can be 
monitored by using the spacecraft, s/c, driven displays. By using the nominal 
attitude program displayed on the clock and vehicle attitude displayed on the 
FDAI , the pilot can generate a value of attitude error for monitoring 
purpos es . 

Attitude Display 


As discussed in the section on attitude error display failure, the 
purpose of the attitude display is to monitor the attitude error display. If 
the attitude display failure is obvious (loss of electrical power, gyro 
tumbles, etc.), then no problem exists. If a slow drift or precession prob- 
lem exists, then it is difficult for the pilot to know what display is in 
error, the attitude error or attitude. If a discrepancy exists between the 
attitude error reading and the FDAI attitude reading minus the nominal atti- 
tude and it is not obvious which display has failed, the trajectory (altitude, 
altitude rate, etc.), parameters and accelerometer display should be monitored 
closely . 

Accelerometer Display 


The most probable failure modes for the accelerometer display are 
saturate or null. These should be obvious to the pilot and, in addition to 
his knowledge of the existing wind conditions and use of the attitude error 
display, the pilot can cross check the display. 

Pilot’s Controller 

The two most probable failure modes are saturate or null. In the event 
one axis of the pilot's controller saturates, the control engines will swing 
hard over and cause an automatic abort during high q regions. During 
noncritical times of flight (with auto abort de-armed) , large attitude and 


rate errors 

will 

build. 

Indications 

: 1 . 

Divergent attitude and rate errors . 


2. 

Divergent accelerometer indications during high q 


3. 

Normal acceleration at pilot's station. 

Procedure : 

1 . 

Disconnect controller. 


In the event of the pilot's controller going to null in one axis, no action 
is required of the pilot. 
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Figure 3.- Saturn V "backup guidance and control system. 
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• Pilot task: Fly load relief with 95% wind, no failures 

• Gain values are for 0< time < 120 sec 



.5 1.0 

Rate gain, deg /deg/sec 


Figure b.- Pilot opinion rating. 



• Pilot task: Fly load relief with 95% wind, no failures 

• Gain values are for 0< time < 120 sec 



Figure 5.- Structural load performance. 


Wind profiles 




Define major failure 
modes and dynamics 
(Probability 
of occurrence) 


Simulate system and 
failure modes 


Define system 


Define pilot 
procedures 


simulation 


Calculate probability of 
mission failure 
(Probability of occurrence 
xconditional probability) 


Conduct simulation 
with random failures 
(Conditional probability) 


Figure 7.- Technique for measuring probability of mission success 










^ Number 

Failure 

Probability 
of occurrence 

1 

One actuator hard over 

5450XI0" 6 

2 

Loss of thrust (One) 

5000 

3 

Two actuators inoperative 

3100 

4 

Loss of platform 

1500 

5 

One actuator oscillatory 

1200 1 

6 

Loss of attitude rate 

300 

7 

One actuator inoperative 

200 

8 

Loss of attitude signal 

* 

9 

Attitude signal saturate 

* 

10 

Attitude rate saturate 

* 

1 1 

Attitude display (Lock, jump, drift) 

1 

12 

Attitude error display null 

— 

13 

Attitude error display saturate 

— 

14 

Attitude rate display null 

— 

15 

Attitude rate display saturate 

— 

16 

Accelerometer display null 

— 

17 

Accelerometer display saturate 

— 

18 

Hand controller null 

50 

^ 19 

Hand controller saturate 

50 J 


* Less than 20 


Figure 8.- List of failures studied and probability of occurrence. 
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Figure 10.- Ames’ rotational hand controller. 
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Figure 13*- Apollo Block I rotational hand controller. 








A-37299 


Figure 15 •- Gemini type pressure suit. 


45 



(a) Unpressurized. 

Figure 1 6 .- Gemini type pressure suit and Apollo Block I hand controller. 
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Figure l6 . - Concluded . 
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00 


One actuator hard over, 95% wind 
load relief system 



Pilot 
O A 
□ B 

O c 



o 


Post max q 
(100-150 sec) 



121 130 141 


control system. 



Max bending moment 
Breakup bending moment 


Pilot 


One actuator hard over, 95% wind 
all systems 


01 

□ 

OJ 


B Load relief 
C 

No load relief 



Figure 18.- Typical system failure data for load relief, no lead relief, and 

automatic control systems. 
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1000 2000 

Effectivity 

Criticality, x I0~ 6 
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One actuator 
hard over 


Load relief 

0.045 

71 

1 1 

0.0 

1 
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i 

54 50 x 1 0~ 6 

No load relief 

.322 



.045 




Automatic 

.488 


“ :i 

. 1 55 




Loss of 
thrust (One) 
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.489 
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5000 


.450 

y.". 4 : 
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.566 



3 

Two actuators 

3100 


.0 i 1 
.084 



.039 
. 1 33 

4— j 


inoperative 



.392 


1 . _ 

.225 


ZH 


Loss of 
platform 



.044 



.044 



4 

1500 


.666 



.0 





.666 



.666 




One actuator 



.577 


7T 


. 282 



5 

1200 


.400 




.266 

•r-i 



oscillatory 


.400 

: ‘ . 



.577 



6 

Loss of 
attitude rate 

300 


.090 

.0 

.80 l 

3 

n 


.0 

.0 

.801 



7 

One actuator 
inoperative 

200 


.0 

.0 

.401 

i 


.0 
. 0 
. 0 



8 

Loss of 
attitude signal 

* 


.0 

.0 

.578 



.0 

.0 

.489 



9 

Attitude signal 
saturate 

* 


.444 

.444 

.667 



.444 

.440 

.667 



10 

Attitude rate 
saturate 

* 


.785 

.667 

1.000 



.888 

.888 

LOOP 



li 

Attitude display 
(Lock,’ jump, drift) 

— 


.0 

.0 

N. A . 



.0 

.0 

N.A. 



12 

Attitude error 
display null 

— 


.0 

.0 

N. A. 



.0 

.0 

N.A. 



13 

Attitude error 
display saturate 

— 


.0 

.0 

N.A. 



.0 

.0 

N.A. 



14 

Attitude rate 
display null 

— 


.0 

.0 

N.A. 



.0 

.0 

N.A. 



15 

Attitude rate 



.0 

n 



.0 



display saturate 



N.A. 



.0 

N.A. 



16 

Accelerometer 
display null 

— 


.0 

.0 

N.A. 



.0 

.0 

N.A. 



17 

Accelerometer 
display saturate 

— 


.6 
.0 
N. A. 



.0 

.0 

N.A. 



18 

Hand controller 
null 

50 


.0 

.0 

N. A. 



.0 

.0 

N.A. 



19 

Hand controller 
saturate 

50 1 


o 

^ < 
sro z * 

i 


.178 

.0 

N.A. 

i 




Load relief 


3300 xi0~ 6 


2990 X icr 6 

* 

N. A. 

Less than 20 
Not applicable 

Iota! 

No load relief 
Automatic 


57 20 
7940 


3320 

6320 



Figure 20.- Saturn IC criticality study; summary of results. 
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Figure 22.- Effect of pressure suit on 


Pilot suit 


O Shirt sleeve 
□ Pressure suit 

O Inflated pressure 
suit (3.7 psig) 
Pilot G 

Apollo controller 



□ 


Into wind 


110 sec) 


72 



Overall 

average 




One actuator hard over, 95% wind 

Pilot 




O G 



□ 

□ H 




Controller 


Cf 


O Ames 

GX 


G 

Cf Apollo 



a 


U0 

OEf 

Ef 



□ 


0$ 

O 



□ 

Away from 

Into wind 

Away from 

Into wind 

wind 


wind 


Pre max q (0-60 sec) 

Max q (6( 

)-IIO sec) 



II 



Two pilots 95% wind 

Controller 

E3 Ames 0 Apollo (Block I) 


Figure 25.- Summary of hand controller comparison. 
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